1

We have a firewall out of our firm network and administrators connect to this firewall by VPN over TLS. Scanning this firewall, the vulnerability scanner get us some warning as the 443 port allow weak ciphers & hash functions like RC4, MD5, SHA1, 3DES ...

So we asked firewall manufacturer how to fix it and they responded that's not possible to remove cipher suite, but as we don't use those ciphers (client side) it's not a vulnerability.

It seems like an easy response to get rid of us. So what is the risk to allow weak ciphers if we use/enforce strong cipher on the client side ?

| improve this question | |
  • 2
    Please see this and this. What if there is a downgrade attack, somewhere? – kelalaka Feb 14 '19 at 16:30
  • 1
    Basically what @kelalaka said. Downgrade to something like RC4 shouldn't be possible if your client only supports secure ciphers, but the RSA attack relies on a side channel in the server implementation to perform operations with the private key, which breaks all ciphers using RSA, not just weak ciphers. There is nothing the client can do to prevent it. – AndrolGenhald Feb 14 '19 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.